CVE-2026-84750 Details
Description
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
A vulnerability exists in the Ultra Addons for Contact Form 7 WordPress plugin in versions prior to 3.5.51. The plugin fails to properly validate the type or extension of files uploaded through a form field, allowing unauthenticated users to upload arbitrary files. These files are stored at a predictable public path with the original extension intact. On servers using the default PHP handler with Debian or Ubuntu Apache, uploaded .phar files are executed as PHP, leading to remote code execution and full site takeover. If the server only routes .php files to the PHP handler, the uploaded file is served from the site's origin with its script intact, resulting in stored cross-site scripting.
Users are advised to update the Ultra Addons for Contact Form 7 WordPress plugin to version 3.5.51 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/44f68354-4be3-422f-9f94-af980b2ebc44/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Ultra Addons | >= 3.2.4, <= 3.5.50 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |